The North Korea-linked hacker group Sapphire Sleet is believed to have stolen over $10 million in cryptocurrency through social engineering campaigns over six months. According to Microsoft, the group has been using fake LinkedIn profiles, posing as recruiters and job seekers to generate money for the nation under sanctions. Active since at least 2020, Sapphire Sleet is related to hacking groups APT38 and BlueNoroff. In November 2023, Microsoft disclosed that the group had set up infrastructure that imitated skills assessment portals for its campaigns. One primary tactic used by Sapphire Sleet involves pretending to be a venture capitalist interested in a target’s company, initiating an online meeting. When targets attempt to join, they encounter error messages urging them to contact the room administrator or support team. If the victim contacts the threat actor, they receive either an AppleScript (. scpt) or Visual Basic Script (. vbs) file, depending on their operating system, under the guise of resolving the issue.

These scripts download malware, allowing attackers access to credentials and cryptocurrency wallets, leading to theft. Sapphire Sleet also impersonates recruiters from financial firms like Goldman Sachs on LinkedIn, luring targets to complete a skills assessment that delivers malware to their devices. Microsoft has noted that North Korea sends thousands of IT workers abroad, creating a revenue stream from "legitimate" work, intellectual property theft, and data theft-for-ransom. These workers use facilitators to access platforms for remote job applications and create fake profiles on sites like GitHub and LinkedIn. In some cases, they employ AI tools like Faceswap to alter stolen photos and documents or to create professional-looking images for resumes and job applications. They also experiment with other AI technologies such as voice-altering software. North Korean IT workers meticulously track their earnings, collectively generating at least $370, 000 through these activities, as per Microsoft’s findings.